gcp-dm-sa-can-set-iam-policy-project

The Google APIs service agent's effective permissions include resourcemanager.projects.setIamPolicy ONLY when it holds roles/owner. A DM config can instruct the SA to call setIamPolicy at project scope, granting the deployer project-level roles.

derived gcp emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`ServiceAccount`
target type	`Identity`
source	`<cloudservices ServiceAccount>`
target	`<attacker-controlled principal to grant project-level roles>`
permissions	`resourcemanager.projects.setIamPolicy`
conditions	`iam_permission`
state logic	ACTIVE ONLY when the SA holds roles/owner or an explicit custom role with resourcemanager.projects.setIamPolicy. CONDITIONAL(iam_permission) if the SA's effective roles are unknown. BLOCKED if an IAM deny policy denies setIamPolicy at the project scope.

source type

ServiceAccount

target type

Identity

source

<cloudservices ServiceAccount>

target

<attacker-controlled principal to grant project-level roles>

permissions

resourcemanager.projects.setIamPolicy

conditions

iam_permission

state logic

ACTIVE ONLY when the SA holds roles/owner or an explicit custom role with resourcemanager.projects.setIamPolicy. CONDITIONAL(iam_permission) if the SA's effective roles are unknown. BLOCKED if an IAM deny policy denies setIamPolicy at the project scope.

Narrative

The Google APIs service agent {sa.name} (roles/owner) can call setIamPolicy at the project scope as part of a Deployment Manager deployment. A deployer can use this to grant any principal elevated project-level roles.

Raw rule rules/derived/gcp/deploymentmanager.yaml

id: gcp-dm-sa-can-set-iam-policy-project
emits: CanGrantPermission
description: The Google APIs service agent's effective permissions include resourcemanager.projects.setIamPolicy
  ONLY when it holds roles/owner. A DM config can instruct the SA to call setIamPolicy at project scope,
  granting the deployer project-level roles.
match:
- - deployment: null
  - ExecutesAs
  - sa: null
where:
- 'node_type(?deployment) == BuildWorker  # DM Deployment node'
- ?sa is the Google APIs service agent (cloudservices SA) for the project
- ?sa holds roles/owner OR a custom role that includes resourcemanager.projects.setIamPolicy
- a deployment config or accessControl section instructs DM to call setIamPolicy on the project IAM policy
emit:
  source_type: ServiceAccount
  target_type: Identity
  source: <cloudservices ServiceAccount>
  target: <attacker-controlled principal to grant project-level roles>
  permissions:
  - resourcemanager.projects.setIamPolicy
  conditions:
  - iam_permission
  state_logic: ACTIVE ONLY when the SA holds roles/owner or an explicit custom role with resourcemanager.projects.setIamPolicy.
    CONDITIONAL(iam_permission) if the SA's effective roles are unknown. BLOCKED if an IAM deny policy
    denies setIamPolicy at the project scope.
  confidence: 0.9
  derived_from:
  - ?deployment ExecutesAs ?sa
  false_positive_note: 'CRITICAL: Editor does NOT include resourcemanager.projects.setIamPolicy. Only
    emit when the SA provably holds roles/owner (via project IAM policy resolution). Do NOT assume the
    default binding; org policy iam.automaticIamGrantsForDefaultServiceAccounts may have removed it.'
  narrative: The Google APIs service agent {sa.name} (roles/owner) can call setIamPolicy at the project
    scope as part of a Deployment Manager deployment. A deployer can use this to grant any principal elevated
    project-level roles.